February 2003 - syslog-ng - lists.balabit.hu

RE: [syslog-ng]Trouble using syslog-ng on Solaris 8
by Hamilton, Andrew 19 Feb '03

19 Feb '03

oops. I should have left out the source(local) on the log line. Drew -----Original Message----- From: Hamilton, Andrew [mailto:Andrew.Hamilton@afccc.af.mil] Sent: Wednesday, February 19, 2003 1:43 PM To: syslog-ng(a)lists.balabit.hu Subject: RE: [syslog-ng]Trouble using syslog-ng on Solaris 8 Your config looks ok. If it is starting ok, make sure you are not still running syslogd. Also, you might try to log everything to a test log file to make sure your host is what you expect in your filters. You can set up something like this: destination all_net { file ("/var/log/net/$HOST.log"); }; log { source(local); source(net); destination(all_net); }; That would at least tell you the hosts that your syslog-ng daemon is seeing. Also you can run syslog-ng with the "-dv" switch to see if syslog-ng is actually catching the traffic. Regards, Drew -----Original Message----- From: Robin Brown [mailto:robin_brown@totalcomm.com] Sent: Wednesday, February 19, 2003 1:36 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]Trouble using syslog-ng on Solaris 8 Hi, running solaris 8 and syslog-ng 1.5.26. It all seems to start just fine, no errors at startup or when running. But none of the logs get populated and I can see the UDP traffic is still coming in. Any way to see if it's simply not matching the host criteria for some reason? Below is my config, any help is appreciated: source net { udp(); }; source local { sun-streams("/dev/log" door("/etc/.syslog_door"));internal(); }; filter f_mine { host("router1") or host("router2") or host("router3"); }; filter f_theirs { host("xxx.xxx.xxx.79"); }; filter f_next { host("xxx.xxx.xxx.230") or host ("xxx.xxx.xxx.129"); }; filter f_right { host("xxx.xxx.xxx.14"); }; destination mine { file("/var/log/mine.log"); }; destination theirs { file("/var/log/theirs.log"); }; destination next { file("/var/log/next.log"); }; destination right { file("/var/log/right.log"); }; destination all { file("/var/adm/messages"); }; log { source(net); filter(f_mine); destination(mine); }; log { source(net); filter(f_theirs); destination(theirs); }; log { source(net); filter(f_next); destination(next); }; log { source(net); filter(f_right); destination(right); }; log { source(local); destination(all); }; Regards, Robin _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

RE: [syslog-ng]Trouble using syslog-ng on Solaris 8
by Hamilton, Andrew 19 Feb '03

19 Feb '03

Your config looks ok. If it is starting ok, make sure you are not still running syslogd. Also, you might try to log everything to a test log file to make sure your host is what you expect in your filters. You can set up something like this: destination all_net { file ("/var/log/net/$HOST.log"); }; log { source(local); source(net); destination(all_net); }; That would at least tell you the hosts that your syslog-ng daemon is seeing. Also you can run syslog-ng with the "-dv" switch to see if syslog-ng is actually catching the traffic. Regards, Drew -----Original Message----- From: Robin Brown [mailto:robin_brown@totalcomm.com] Sent: Wednesday, February 19, 2003 1:36 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]Trouble using syslog-ng on Solaris 8 Hi, running solaris 8 and syslog-ng 1.5.26. It all seems to start just fine, no errors at startup or when running. But none of the logs get populated and I can see the UDP traffic is still coming in. Any way to see if it's simply not matching the host criteria for some reason? Below is my config, any help is appreciated: source net { udp(); }; source local { sun-streams("/dev/log" door("/etc/.syslog_door"));internal(); }; filter f_mine { host("router1") or host("router2") or host("router3"); }; filter f_theirs { host("xxx.xxx.xxx.79"); }; filter f_next { host("xxx.xxx.xxx.230") or host ("xxx.xxx.xxx.129"); }; filter f_right { host("xxx.xxx.xxx.14"); }; destination mine { file("/var/log/mine.log"); }; destination theirs { file("/var/log/theirs.log"); }; destination next { file("/var/log/next.log"); }; destination right { file("/var/log/right.log"); }; destination all { file("/var/adm/messages"); }; log { source(net); filter(f_mine); destination(mine); }; log { source(net); filter(f_theirs); destination(theirs); }; log { source(net); filter(f_next); destination(next); }; log { source(net); filter(f_right); destination(right); }; log { source(local); destination(all); }; Regards, Robin _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

Trouble using syslog-ng on Solaris 8
by Robin Brown 19 Feb '03

19 Feb '03

Hi, running solaris 8 and syslog-ng 1.5.26. It all seems to start just fine, no errors at startup or when running. But none of the logs get populated and I can see the UDP traffic is still coming in. Any way to see if it's simply not matching the host criteria for some reason? Below is my config, any help is appreciated: source net { udp(); }; source local { sun-streams("/dev/log" door("/etc/.syslog_door"));internal(); }; filter f_mine { host("router1") or host("router2") or host("router3"); }; filter f_theirs { host("xxx.xxx.xxx.79"); }; filter f_next { host("xxx.xxx.xxx.230") or host ("xxx.xxx.xxx.129"); }; filter f_right { host("xxx.xxx.xxx.14"); }; destination mine { file("/var/log/mine.log"); }; destination theirs { file("/var/log/theirs.log"); }; destination next { file("/var/log/next.log"); }; destination right { file("/var/log/right.log"); }; destination all { file("/var/adm/messages"); }; log { source(net); filter(f_mine); destination(mine); }; log { source(net); filter(f_theirs); destination(theirs); }; log { source(net); filter(f_next); destination(next); }; log { source(net); filter(f_right); destination(right); }; log { source(local); destination(all); }; Regards, Robin

1 0

syslog-ng at CeBIT 2003
by Balazs Scheidler 19 Feb '03

19 Feb '03

syslog-ng at CeBIT 2003 CeBIT is one of the largest IT trade shows in Europe and this year it will be a good meeting point where syslog-ng users and developers can meet and discuss the future of this successful open source project. You can find us at stand A15 in Hall 8. Syslog-ng development is currently funded by BalaBit IT Ltd, a successful Hungarian security firm now heading to the international market with its software products, primarily syslog-ng and Zorp. I assume syslog-ng itself does not need to be introduced here. The news about syslog-ng is that syslog-ng as a product will be announced. Zorp is a firewall product primarily targeted at medium to high risk environments. The firewall core has the following important features: * application layer protocol analysis, enforcing 100% RFC compliance for the following protocols: FINGER, FTP, HTTP, IMAP, LDAP, LP, NNTP, PLUG, POP3, SSL/TLS, RADIUS Oracle SQLNET, TELNET, TFTP, WHOIS * flexible decision engine, so both decisions and exception to those can freely be described * modularity so you can attach different proxies together in a way similar to how protocols are assembled together (HTTP within SSL) * strong authentication support * integrated PKI for X.509 key management Zorp Professional is distributed as a complete solution with its own operating system (Zorp OS), management server (ZMS) and management console (ZMC). Both Zorp and syslog-ng is available as free software under the terms of the GNU GPL, though some of the functions are missing or are limited. Our visit to CeBIT is aimed at the introduction of Zorp and syslog-ng to the commercial sector. We are primarily focusing on companies which are able to provide either Zorp or syslog-ng related support and system integration services. Interested parties should contact mailto:info@balabit.com to make appointments during the trade show. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

2 3

syslog-ng log file rotation based on size
by Nate Campi 18 Feb '03

18 Feb '03

Many of us run syslog-ng on systems with a 2 gig file size limit. An attacker can flood our loghost until logs reach 2 gigs in size, at which point syslog-ng cannot write to the file any further. If you run cfengine on your loghost, you can make it rotate logs based on size: -------------------------------------------------------- disable: loghost:: /var/log/messages size=>2000mb rotate=100 define=syslog_rotated /var/log/syslog size=>2000mb rotate=100 define=syslog_rotated processes: loghost.syslog_rotated:: "syslog-ng" signal=hup shellcommands: loghost.syslog_rotated:: "/bin/echo a log file in /var/log was rotated to avoid the 2 gig file limit on loghost|/usr/bin/mail -s'cfengine did an emergency syslog log rotation on loghost' oncall@example" -------------------------------------------------------- I'm sure there's other out of band mechanisms that could be used (a shell script whipped up in a few minutes could do it, run from cron), but it's important to think about it. Even if you have huge disks, if your OS/filesystem/file utilities can't handle large files you're in trouble. Perhaps down the road syslog-ng could include a feature to help with this. It doesn't eliminate the threat of attackers flooding your logs, but at least it could make every effort to keep from losing logs (until your filesystem fills up or the host's CPU/memory resources get overloaded under the flood, I know this isn't perfect). Even if the host OS can handle huge files, from an administration standpoint it's sometimes best to keep them smaller and deal with them in smaller chunks anyways; especially when you need to rotate logs off a machine to save local disk space. Any hope of such a feature Bazsi? Perhaps in syslog-ng 2? -- Nate Campi http://www.campin.net The porcupine with the sharpest quills gets stuck on a tree more often.

5 11

Re: fdread.h in syslog-ng-1.9.1
by Balazs Scheidler 18 Feb '03

18 Feb '03

On Sun, Feb 16, 2003 at 08:54:17AM -0500, mclinden(a)informed.net wrote: > Greetings! > > The file src/fdread.h seems to be missing from the latest tarball of > syslog-ng-1.9.1 Please try the daily snapshots at http://www.balabit.com/downloads/syslog-ng/1.9/src-snapshot/ -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

1 0

balabit.hu site redesign
by Nate Campi 18 Feb '03

18 Feb '03

The balabit site looks good, but without syslog-ng and libol versions side by side on the dowload page it is hard to know which goes with which. I suggest pairing up the libol and syslog-ng versions like before. We might have a lot of confused people posting to this list. -- Nate Campi http://www.campin.net

2 2

AW: [syslog-ng]versions
by Mischke Martin 17 Feb '03

17 Feb '03

yeah i tried 1.5.26 and it works fine for me as far as i tested. The problem is, i need templates for logging into MySQL DB's directly. AFAIK 1.4.x doesn't support templates. So i can't revert to 1.4.x right?!? -----Ursprüngliche Nachricht----- Von: Balazs Scheidler [mailto:bazsi@balabit.hu] Gesendet: Montag, 17. Februar 2003 14:48 An: syslog-ng(a)lists.balabit.hu Betreff: Re: [syslog-ng]versions On Mon, Feb 17, 2003 at 10:55:29AM +0100, Mischke Martin wrote: > Hi, > I'm new to this list. > I want to install syslog-ng. But I'm confused about all the versions. > Which one are you all using?!? > Stable says: 1.4.17 > But there's already version 1.9. you should use 1.5.26 and revert to 1.4.17 if you have problems. 1.9.x is for developers only. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

versions
by Mischke Martin 17 Feb '03

17 Feb '03

Hi, I'm new to this list. I want to install syslog-ng. But I'm confused about all the versions. Which one are you all using?!? Stable says: 1.4.17 But there's already version 1.9. Thanks in advance. Martin Mischke

2 1

Loggin Server (part 2)
by Iulian Topliceanu 17 Feb '03

17 Feb '03

Hej again, I'm sort of confused... syslogd sends its logs via UDP (right?)... and I've noticed that syslog-ng gets them viat TCP?! (or does it refer just ot the stunnel?) Is there a possibility to combine syslog (on the client machine) with syslog-ng on the logging machine? Am I missing something? Pease help! Iulian Topliceanu

2 1